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Before JAMES D. THOMAS, ALLEN R. MACDONALD, and 
STEPHEN C. SIU, Administrative Patent Judges . 

SIU, Administrative Patent Judge. 

DECISION ON APPEAL 
1. STATEMENT OF THE CASE 
Appellants appeal under 35 U.S.C. § 134(a) from the Examiner's 
Final Rejection of claims 1-13. We have jurisdiction under 35 U.S.C. 
§ 6(b). We affirm. 
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A. Invention 

1 The invention at issue involves intrusion detection in a network 
(Spec. 1). In particular, an intrusion detection application stored in a 
memory module of a mobile device is executed at a node in a network {id. 
8). A signature file is transmitted from a management node to other nodes in 
the network (/i/. 15-16). 

B. Illustrative Claim 
Claim 1, which fiuther illustrates the invention, follows: 

I . A mobile device operable in a mobile telecommunications 

network, comprising: 

a memory module for storing data in machine readable format for 
retrieval and execution by a central processing unit; and 

an operating system operable to execute an intrusion detection 
application stored in the memory module. 

C. Rejections 

Claims 1 and 3-10 stand rejected under 35 U.S.C. § 102(e) as being 
anticipated by U.S. Patent No. 6,725,377 ("Kouznetsov"). Claim 2 stands 
rejected under 35 U.S.C. § 103(a) as being unpatentable over Kouznetsov 
and U.S. Patent No. 6,851,061 ("Holland"). Claims 11-13 stand rejected 
under 35 U.S.C. § 103(a) as being unpatentable over Holland and U.S. 
Patent No. 5,557,742 ("Smaha"). 
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11. CLAIM GROUPING 

r'When multiple claims subject to the same ground of rejection are 
argued as a group by appellant, the Board may select a single claim from the 
group of claims that are argued together to decide the appeal with respect to 
the group of claims as to the ground of rejection on the basis of the selected 
claim alone. Notwithstanding any other provision of this paragraph, the 
failure of appellant to separately argue claims which appellant has grouped 
together shall constitute a waiver of any argument that the Board must 
consider the patentability of any grouped claim separately." 37 C.F.R. 
§41.37(c)(l)(vii) (2005).' 

Appellants argue claims 1 and 3-10 as a first group (App. Br. 5-6) and 
claims 1 1-13 as a second group (id. 7-9). Appellants argue claim 2 
separately. We select claim 1 as the sole claim on which to decide the 
appeal of the first group and claim 1 1 as the sole claim on which to decide 
the appeal of the second group. We consider claim 2 separately. 

III. CLAIMS 1 AND 3-10 
As set forth above, we select claim 1 as the sole claim on which to 

decide the appeal of the first group. "Rather than reiterate the positions of 
parties in toto, we focus on the issue therebetween." Ex Parte Filatov, No. 
2006-1 160, 2007 WL 1317144, at *2 (BPAI 2007). 

^ We cite to the version of the Code of Federal Regulations in effect at the 
time of the Appeal Brief. The current version includes the same rules. 
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Appellants argue that Kouznetsov "does not disclose ... 'an intrusion 
detection application stored in a memory module' of a 'mobile device 
operable in a mobile telecommunications network' as recited by independent 
Claim 1" (App. Br. 5). 

The Examiner finds that "any type of computer on which the 
software program (of Kouznetsov) is loaded meets the limitation of 
portable device" (Ans. 12). In the absence of an explicit definition of 
"mobile device" in the specification, we adopt a plain and ordinary 
definition as "any device that is mobile." Chef America, Inc. v. Lamb- 
Weston, Inc., 358 F.3d 1371, 1373 (Fed. Cir. 2004) (Ordinary, simple 
English words whose meaning is clear and unquestionable, absent any 
indication that their use in a particular context changes their meaning, are 
construed to mean exactly what they say). We further adopt the reasonably 
broad, plain and ordinary meaning of "mobile" to include "able to move 
freely." "[T]he PTO gives claims their 'broadest reasonable interpretation.'" 
In re Bigio, 381 F.3d 1320, 1324 (Fed. Cir. 2004) (quoting In re Hyatt, 211 
F.3d 1367, 1372 (Fed. Cir. 2000)). Based on the record before us, we agree 
with the Examiner that Kouznetsov discloses a "mobile device" according to 
the plain meaning of the term. For example, Kouznetsov discloses that a 
server is "any type of computer on which the software program is loaded." 
We find that "any type of computer" includes computing devices that are 
able to be moved freely (i.e., "mobile"), such as laptop computers. We are 
therefore unconvinced by Appellants' argument. 
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Appellants further assert that "the recitation of 'mobile device' in the 
preamble clearly constitutes a structural limitation" (Reply Br. 3) and that 
"the preamble of independent Claim 1 forms a basis for distinguishing over 
the Kousznetsov reference and, as such, is a claim limitation" (App. Br. 6). 

The preamble of claim 1 recites "a mobile device operable in a mobile 
telecommunications network." Independently of the preamble, the structure 
of the device is completely defined in the body of the claim as comprising a 
memory module and an operating system. Also, the body of claim 1 does 
not recite any structural limitations associated with the mobile device in the 
mobile telecommunications network recited in the preamble. Because the 
body of the claim recites a self-contained description of the structure that 
does not depend on the preamble for completeness, we agree with the 
Examiner that the preamble does not constitute a limitation upon structure. 
"The preamble has been denied the effect of a limitation where the claim or 
count was drawn to a structure and the portion of the claim following the 
preamble was a self-contained description of the structure not depending for 
completeness upon the introductory clause." Kropa v. Robie et al, 187 F.2d 
150,152 (CCPA1951). 

In addition, claim 1 recites in tlie preamble that the mobile device is 
"operable in a mobile telecommunications network." Because claim 1 is a 
structural claim of a device that recites no more than the capability of being 
"operable" in a network, we agree with the Examiner that the device of 
claim 1 must be tested according to the structure defined in claim 1 and not 
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by the use which is to be made of the device. As set forth supra, the body of 
claim 1 recites that the device comprises a memory module and an operating 
system, neither of which depends on the preamble. Thus, we find that the 
recitation of "operable in a mobile telecommunications network" in the 
preamble of claim 1 does not constitute a limitation on structure. In re 
Casey, 370 F.2d 576 (CCPA 1967) ("Preambles are used primarily to give 
the field within which the invention has utility. They designate use rather 
than structure, form or composition."). 

It follows that Appellants have failed to demonstrate that the 
Examiner erred in rejecting claim 1. Therefore, we affirm the rejection of 
claim 1 and of claims 3-10, which fall therewith. 

IV. CLAIMS 11-13 

As set forth above, we select claim 1 1 as the sole claim on which to 
decide the appeal of the second group. 

Appellants argue that ''Smaha 'converts the input into events/signature 
and compare[s] it with the known signatures' (Final Office Action, page 4, 
and page 1 1)" (App. Br. 7) but fails to disclose "an intrusion protection 
system management application . . . operable to receive text-file input 
defining a network-exploit rule and convert the text-file input into a 
signature file comprising machine-readable logic representative of an 
exploit-signature'" {id. 8). Appellants also argue that "Smaha clearly do not 
'defm[e] a network exploit rule' as recited by Claim 11" {id.). 
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Smaha discloses "an intrusion misuse detection" system (col. 3, 11. 31- 
32) in which a "load mechanism 102 receives selectable misuse data" (col. 
8, 11. 1 1-12). The "load mechanism 102 loads the misuse elements to 
signature data structure 108" (col. 8, 11. 17-18), the signature data structure 
108 "containing elements . . . (that) embody a computer representation of a 
misuse (i.e., a signature data structure 108)" (col. 8, 11. 30-35). We disagree 
with Appellants that Smaha fails to disclose the disputed limitations of claim 
11. Specifically, Smaha discloses "an intrusion protection system" (i.e., an 
"intrusion misuse detection" system) that is operable to "receive a text-file 
inpuf (i.e., receiving "misuse data" at a "load mechanism") that defines a 
network-exploit rule (i.e., the "misuse data" defines misuse or intrusion of 
the system). Smaha further discloses converting the input into a signature 
file (i.e., loading misuse elements to a signature data structure) that 
comprises machine-readable logic of an exploit-signature (i.e., the signature 
data structure that embodies a computer representation of a misuse). "[T]he 
PTO gives claims their 'broadest reasonable interpretation.'" In re Bigio, 
381 F.3d at 1324 (Fed. Cir. 2004) (quoting In re Hyatt, 211 F.3d 1367, 1372 
(Fed. Cir. 2000)). Appellants have failed to establish substantial differences 
between the Smaha disclosure and the disputed elements of claim 1 1 . 

Appellants further argue that "nowhere does Smaha disclose, teach or 
suggest a mobile device" (App. Br. 9). 

As set forth above, in the absence of an explicit definition of "mobile 
device" in the Specification, we construe the term using the plain and 
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ordinary meaning of "any device that can be moved." Smaha discloses a 
"network device" and "computer memory device" (col. 4, 11. 54-55). We 
find that any of these devices encompass devices that are capable of being 
moved. Therefore, we disagree with Appellants that Smaha fails to disclose 
a mobile device. 

Appellants also argue that Smaha discloses "an output of 'an output 
signal' and an 'output report,' neither of which appear to be a 'signature file' 
as recited by claim 1 1" (App. Br. 9). 

For reasons set forth supra, we disagree with Appellants that Smaha 
fails to disclose a "signature file." 

It follows that Appellants have failed to demonstrate that the 
Examiner erred in rejecting claim 11. Therefore, we affirm the rejection of 
claim 1 1 and of claims 12 and 13, which fall therewith. 

V. CLAIM 2 

Appellants argue that Kouznetsov and Holland fail to disclose "'an 
intrusion detection application stored in the memory module' of a 'mobile 
device operable in a mobile telecommunications network'" (Reply Br. 6). 
However, Appellants rely on the same arguments as those presented for 
claim 1 with respect to Kouznetsov. For reasons set forth above for claim 1, 
we are unconvinced by Appellants' arguments. 

It follows that Appellants have failed to demonstrate that the 
Examiner erred in rejecting claim 2. 

8 



Appeal 2007-4499 
Application 10/001,728 



VII. ORDER 

In summary, the rejection of claims 1 and 3-10 under § 102(e) is 
affirmed and the rejections of claims 2 and 11-13 under § 103(a) are 
affirmed. 

No time for taking any action connected with this appeal may be 
extended under 37 C.F.R. § 1.136(a)(l)(iv). 



AFFIRMED 
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